map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_bpf
#define __NR_bpf 321
#endif
uint64_t r[4] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// bpf$MAP_CREATE arguments: [
// cmd: const = 0x0 (8 bytes)
// arg: ptr[in, bpf_map_create_arg] {
// union bpf_map_create_arg {
// base: bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]] {
// type: bpf_map_type = 0x4 (4 bytes)
// ksize: int32 = 0x0 (4 bytes)
// vsize: int32 = 0x31 (4 bytes)
// max: int32 = 0x0 (4 bytes)
// flags: map_flags = 0x0 (4 bytes)
// inner: fd_bpf_map (resource)
// node: int32 = 0x0 (4 bytes)
// map_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// map_ifindex: ifindex (resource)
// btf_fd: fd_btf (resource)
// btf_key_type_id: int32 = 0x0 (4 bytes)
// btf_value_type_id: int32 = 0x0 (4 bytes)
// btf_vmlinux_type_id: int32 = 0x0 (4 bytes)
// map_extra: const = 0x0 (8 bytes)
// value_type_btf_obj_fd: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]]_value_type_btf_obj_fd_wrapper {
// void: buffer: {} (length 0x0)
// }
// pad1: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]]_pad1_wrapper {
// value: const = 0x0 (4 bytes)
// }
// map_token_fd: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]]_map_token_fd_wrapper {
// void: buffer: {} (length 0x0)
// }
// pad2: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]]_pad2_wrapper {
// value: const = 0x0 (4 bytes)
// }
// }
// }
// }
// size: len = 0x48 (8 bytes)
// ]
// returns fd_bpf_map
*(uint32_t*)0x200000000000 = 4;
*(uint32_t*)0x200000000004 = 0;
*(uint32_t*)0x200000000008 = 0x31;
*(uint32_t*)0x20000000000c = 0;
*(uint32_t*)0x200000000010 = 0;
*(uint32_t*)0x200000000014 = -1;
*(uint32_t*)0x200000000018 = 0;
memset((void*)0x20000000001c, 0, 16);
*(uint32_t*)0x20000000002c = 0;
*(uint32_t*)0x200000000030 = -1;
*(uint32_t*)0x200000000034 = 0;
*(uint32_t*)0x200000000038 = 0;
*(uint32_t*)0x20000000003c = 0;
*(uint64_t*)0x200000000040 = 0;
*(uint32_t*)0x200000000048 = 0;
*(uint32_t*)0x20000000004c = 0;
syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x200000000000ul, /*size=*/0x48ul);
// socketpair$nbd arguments: [
// domain: const = 0x1 (8 bytes)
// type: const = 0x1 (8 bytes)
// proto: const = 0x0 (4 bytes)
// fds: ptr[out, nbd_sock_pair] {
// nbd_sock_pair {
// client: sock_nbd_client (resource)
// server: sock_nbd_server (resource)
// }
// }
// ]
res = syscall(__NR_socketpair, /*domain=*/1ul, /*type=*/1ul, /*proto=*/0, /*fds=*/0x200000000180ul);
if (res != -1)
r[0] = *(uint32_t*)0x200000000184;
// ioctl$SIOCSIFHWADDR arguments: [
// fd: fd_tun (resource)
// cmd: const = 0x89f0 (4 bytes)
// arg: ptr[in, ifreq_dev_t[devnames, mac_addr]] {
// ifreq_dev_t[devnames, mac_addr] {
// ifr_ifrn: buffer: {62 72 69 64 67 65 30 00 00 00 00 00 00 00 00 00} (length 0x10)
// elem: union mac_addr {
// random: buffer: {00 00 00 20 00 00} (length 0x6)
// }
// pad = 0x0 (18 bytes)
// }
// }
// ]
memcpy((void*)0x200000000900, "bridge0\000\000\000\000\000\000\000\000\000", 16);
memcpy((void*)0x200000000910, "\000\000\000 \000\000", 6);
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0x89f0, /*arg=*/0x200000000900ul);
// socket$nl_route arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_nl_route
syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
// socket$inet_udplite arguments: [
// domain: const = 0x2 (8 bytes)
// type: const = 0x2 (8 bytes)
// proto: const = 0x88 (4 bytes)
// ]
// returns sock_udp
syscall(__NR_socket, /*domain=*/2ul, /*type=*/2ul, /*proto=*/0x88);
// bpf$MAP_CREATE arguments: [
// cmd: const = 0x0 (8 bytes)
// arg: ptr[in, bpf_map_create_arg] {
// union bpf_map_create_arg {
// base: bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]] {
// type: bpf_map_type = 0x2 (4 bytes)
// ksize: int32 = 0x4 (4 bytes)
// vsize: int32 = 0x5 (4 bytes)
// max: int32 = 0x2 (4 bytes)
// flags: map_flags = 0x0 (4 bytes)
// inner: fd_bpf_map (resource)
// node: int32 = 0x0 (4 bytes)
// map_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
// map_ifindex: ifindex (resource)
// btf_fd: fd_btf (resource)
// btf_key_type_id: int32 = 0x0 (4 bytes)
// btf_value_type_id: int32 = 0x0 (4 bytes)
// btf_vmlinux_type_id: int32 = 0x0 (4 bytes)
// map_extra: const = 0x0 (8 bytes)
// value_type_btf_obj_fd: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]]_value_type_btf_obj_fd_wrapper {
// void: buffer: {} (length 0x0)
// }
// pad1: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]]_pad1_wrapper {
// value: const = 0x0 (4 bytes)
// }
// map_token_fd: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]]_map_token_fd_wrapper {
// void: buffer: {} (length 0x0)
// }
// pad2: union _bpf_map_create_arg_t[flags[bpf_map_type, int32], int32, int32, int32, flags[map_flags, int32], const[0, int64]]_pad2_wrapper {
// value: const = 0x0 (4 bytes)
// }
// }
// }
// }
// size: len = 0x48 (8 bytes)
// ]
// returns fd_bpf_map
*(uint32_t*)0x2000000009c0 = 2;
*(uint32_t*)0x2000000009c4 = 4;
*(uint32_t*)0x2000000009c8 = 5;
*(uint32_t*)0x2000000009cc = 2;
*(uint32_t*)0x2000000009d0 = 0;
*(uint32_t*)0x2000000009d4 = -1;
*(uint32_t*)0x2000000009d8 = 0;
memset((void*)0x2000000009dc, 0, 16);
*(uint32_t*)0x2000000009ec = 0;
*(uint32_t*)0x2000000009f0 = -1;
*(uint32_t*)0x2000000009f4 = 0;
*(uint32_t*)0x2000000009f8 = 0;
*(uint32_t*)0x2000000009fc = 0;
*(uint64_t*)0x200000000a00 = 0;
*(uint32_t*)0x200000000a08 = 0;
*(uint32_t*)0x200000000a0c = 0;
syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x2000000009c0ul, /*size=*/0x48ul);
// close arguments: [
// fd: fd (resource)
// ]
syscall(__NR_close, /*fd=*/(intptr_t)-1);
// openat$cgroup_ro arguments: [
// fd: fd_cgroup (resource)
// file: ptr[in, buffer] {
// buffer: {6d 65 6d 6f 72 79 2e 65 76 65 6e 74 73 00} (length 0xe)
// }
// flags: const = 0x275a (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd
memcpy((void*)0x2000000000c0, "memory.events\000", 14);
syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x2000000000c0ul, /*flags=*/0x275a, /*mode=*/0);
// socket$nl_route arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_nl_route
syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
// socket$nl_route arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_nl_route
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[1] = res;
// socket$nl_generic arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x10 (4 bytes)
// ]
// returns sock_nl_generic
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0x10);
if (res != -1)
r[2] = res;
// openat$uhid arguments: [
// fd: const = 0xffffffffffffff9c (8 bytes)
// file: ptr[in, buffer] {
// buffer: {2f 64 65 76 2f 75 68 69 64 00} (length 0xa)
// }
// flags: uhid_open_flags = 0x0 (4 bytes)
// mode: const = 0x0 (2 bytes)
// ]
// returns fd_uhid
memcpy((void*)0x200000000000, "/dev/uhid\000", 10);
syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x200000000000ul, /*flags=*/0, /*mode=*/0);
// socket$nl_route arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_nl_route
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[3] = res;
// sendmsg$nl_route arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route]] {
// msghdr_netlink[netlink_msg_route] {
// addr: nil
// addrlen: len = 0x3 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route]] {
// iovec[in, netlink_msg_route] {
// addr: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {40 00 00 00 10 00 3b 15 00 00 00 00 00 00 00 00 00 00 48 88} (length 0x14)
// }
// union ANYUNION {
// ANYRES32: ANYRES32 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {d5 30 d9 95 21 2c f9 5a 20 00 12 80 08 00 01 00 68 73 72 00 14 00 02 80 08 00 02 00} (length 0x1c)
// }
// union ANYUNION {
// ANYRES32: ANYRES32 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {08 00 01 00} (length 0x4)
// }
// union ANYUNION {
// ANYRES64: ANYRES64 (resource)
// }
// }
// }
// len: len = 0x40 (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x2000000000c0 = 0;
*(uint32_t*)0x2000000000c8 = 3;
*(uint64_t*)0x2000000000d0 = 0x200000000000;
*(uint64_t*)0x200000000000 = 0x200000000100;
memcpy((void*)0x200000000100, "\x40\x00\x00\x00\x10\x00\x3b\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x48\x88", 20);
*(uint32_t*)0x200000000114 = 0;
memcpy((void*)0x200000000118, "\xd5\x30\xd9\x95\x21\x2c\xf9\x5a\x20\x00\x12\x80\x08\x00\x01\x00\x68\x73\x72\x00\x14\x00\x02\x80\x08\x00\x02\x00", 28);
*(uint32_t*)0x200000000134 = r[3];
memcpy((void*)0x200000000138, "\x08\x00\x01\x00", 4);
*(uint64_t*)0x20000000013c = r[2];
*(uint64_t*)0x200000000008 = 0x40;
*(uint64_t*)0x2000000000d8 = 1;
*(uint64_t*)0x2000000000e0 = 0;
*(uint64_t*)0x2000000000e8 = 0;
*(uint32_t*)0x2000000000f0 = 0;
syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x2000000000c0ul, /*f=*/0ul);
return 0;
}
]